This article explains what a PDF SDK for banking apps has to handle, from statements and loan forms to signatures and encryption, and how RadaeePDF covers each step.

Applies to: RadaeePDF Classic and Master SDK for Android, iOS and Windows UWP, and RadaeePDF SDK Server (Windows and Linux). Code samples target the Master SDK for Android and the Server Java binding.

Key takeaways:

A PDF SDK for banking apps keeps statements, contracts and forms inside the app instead of handing them to an external viewer.
RadaeePDF covers form filling, signature verification and AES-256 encryption with documented APIs.
The same engine runs on Android, iOS, Windows and on Linux or Windows servers for statement generation.
Compliance depends on your processes: use this as a planning aid, not legal advice.

A customer who opens an account statement or a mortgage contract in a banking app expects to see it right away, inside the app, without being bounced to another viewer. For the engineering team, that convenience comes with responsibility. Every document carries account numbers, balances and identity data, and many of them need a signature or a password before they can leave the bank.

This article walks through the document steps of a typical banking or insurance app and maps each one to a capability you can verify in the RadaeePDF SDK sources and product pages. It is a planning aid, not legal advice. Regulatory obligations such as data protection rules depend on your own processes, so confirm them with your compliance team.

The document lifecycle in a PDF SDK for banking apps

RadaeePDF’s Bank Operations page lists the typical needs of the sector. Arranged as a workflow, they become five steps:

Generate and archive. Create bank statements and other financial documents as PDF, and convert paper records to PDF for archiving and digital sharing.
Collect data with forms. Let customers fill in loan or financing requests directly in the document form.
Sign and verify. Insert digital signatures on contracts to simplify approval and underwriting, and check signatures on documents you receive.
Protect. Restrict access to sensitive documents with passwords and encryption.
Redact. Remove sensitive data permanently before a document is shared.

The sections below cover what the SDK offers for each step.

1. Statement generation and archiving

Monthly statements are usually produced in batch, on a server. The RadaeePDF SDK Server README describes the server edition as built from native C++ code. It ships prebuilt binaries for Windows (x64, x86) and Ubuntu 22.04/24.04 (x64, with an ARM64 build for 22.04), and offers C#, Java and command-line bindings. The Python binding is listed as “coming soon”.

The README lists creating and editing annotations, reading and writing AcroForm fields, text search and extraction, AES-256 protection, and signing and verifying documents. The Java binding exposes Document.Create(path) to start a new PDF, and its demo project includes a TestPDFCreate.java sample.

For batch jobs that don’t need custom code, the CLI tools cover common tasks:

rdpage extracts text, renders pages to images, and deletes, rotates or imports pages.
rdsec encrypts, decrypts, signs and watermarks files.
rdinfo shows file information and metadata.

Server licensing is per installation. The licensing fact sheet states that each workstation or server is identified by a unique ID, and that the server license “does not restrict concurrent processes or applications invoking the runtime”.

2. Loan and financing applications with AcroForms

The product pages for Android, iOS and Windows UWP say the same thing: if a PDF contains AcroForm fields, users can fill them in through the viewer UI, or your code can fill them programmatically. The pages also mention creating new AcroForm fields in existing documents.

In the Android Java API, form fields are annotations. Page.Annotation.GetFieldType() tells you the field type: 1 is a button, 2 a text field, 3 a choice field, 4 a signature field. You then write values with SetEditText, SetComboItem or SetCheckValue. All three require a Premium license.

To hand the data to a back end, Document.ExportForm() returns the form data as an XML string and Document.ExportXFDF(href) returns XFDF. Your loan system can then process the submitted values without scraping the PDF.

3. Contract signing and signature verification

Signatures are where a banking workflow gains or loses trust. The SDK covers both sides:

Signing. Page.Annotation.SignField(form, cert_file, pswd, name, reason, location, contact) signs an empty signature field with a .p12 or .pfx certificate and requires a Premium license. It returns 0 on success and negative codes for problems such as “cert file open failed” (-5). On servers, rdsec -sig does the same from the command line.
Verification. Document.VerifySign(sign) checks a signature object taken from a signature field. Per its doc comment, it returns “0 if verify OK, others are error” and needs a Premium license.

The following method lists every signature field in a document and verifies the signed ones. It targets the Master SDK for Android. The same classes and methods exist in the Server Java binding (com.radaee.pdf), so it compiles there too. Activate the license first: Global.Init(context) on Android, Global.Init(serial) on Server.

import com.radaee.pdf.Document;
import com.radaee.pdf.Page;
import com.radaee.pdf.Sign;

public final class SignatureChecker {

    /** Prints the status of every signature field. Returns false if the file cannot be opened. */
    public static boolean checkSignatures(String path, String password) {
        Document doc = new Document();
        int err = doc.Open(path, password);
        if (err != 0) {
            System.out.println("Open failed: " + err); // -1 = password required
            return false;
        }
        try {
            int pageCount = doc.GetPageCount();
            for (int p = 0; p < pageCount; p++) {
                Page page = doc.GetPage(p);
                if (page == null) continue;
                page.ObjsStart();
                int annotCount = page.GetAnnotCount();
                for (int i = 0; i < annotCount; i++) {
                    Page.Annotation annot = page.GetAnnot(i);
                    if (annot == null || annot.GetFieldType() != 4) continue; // 4 = signature field
                    String field = annot.GetFieldFullName();
                    if (annot.GetSignStatus() != 1) {                         // 1 = signed
                        System.out.println(field + ": not signed");
                        continue;
                    }
                    Sign sign = annot.GetSign();
                    if (sign == null) continue;
                    int result = doc.VerifySign(sign);
                    System.out.println(field + " signed by " + sign.GetName()
                            + " on " + sign.GetModDateTime()
                            + (result == 0 ? ": valid" : ": verification error " + result));
                }
                page.Close();
            }
            return true;
        } finally {
            doc.Close();
        }
    }
}

Document.GetPerm() adds another check. It reads the Perm entry of the catalog, which according to the doc comment “mostly … means the permission from signature”. A value of 1 means the document can’t be modified.

4. Protecting statements with passwords and AES encryption

Document.EncryptAs(dst, upswd, opswd, perm, method, id) writes an encrypted copy of a document and requires a Premium license. On Android, Windows UWP and the Server Java binding, method = 3 selects AES-256 (Acrobat X, V=5/R=6), and any other value selects AES-128 (V=4/R=4). The iOS headers document method as reserved. The id must be 32 bytes, so generate it with a cryptographic random source:

import com.radaee.pdf.Document;

import java.security.SecureRandom;

public final class StatementProtector {

    public static boolean protectStatement(String src, String dst,
                                           String customerPwd, String bankOwnerPwd) {
        Document doc = new Document();
        if (doc.Open(src, null) != 0) return false;
        try {
            byte[] fileId = new byte[32];
            new SecureRandom().nextBytes(fileId);
            int perm = ~(0x8 | 0x10); // allow print, block modify and text/image extraction
            return doc.EncryptAs(dst, customerPwd, bankOwnerPwd, perm, 3, fileId);
        } finally {
            doc.Close();
        }
    }
}

The customer opens the file with the user password and gets the permission mask you set. The bank keeps the owner password, which opens the file without restrictions. For a step-by-step walkthrough, see Encrypt PDF with AES-256 on Android and the Encrypt a PDF knowledge base article.

The rest of the security picture is outside the PDF. Store passwords and keys in the platform keystore and never in the app bundle. The PDF permission mask is honored by compliant viewers, but it doesn’t replace access control on your servers.

For on-screen deterrence, rdsec -wm adds a PNG watermark to every page of a file on the server, for example before a statement is exported.

5. Redaction

Redaction is the step where the original draft promised the most. The Bank Operations page lists redaction, “permanently removing all sensitive data included in a PDF document”. However, the API documentation in the public demo repositories for Android, iOS, Windows and Server doesn’t contain a redaction method. If your workflow depends on true redaction, which removes the underlying text and images rather than covering them with a black box, ask RadaeePDF which edition and API provide it before you design around it. Whether the result meets a specific privacy regulation depends on your process, not only on the tool.

Why native, in-app rendering matters

According to the product pages, the Android SDK’s Java framework runs on “a fast and stable native library optimized to work on ARM, x86 architectures (both 32bit and 64bit)”. The iOS and Windows frameworks sit on the same C++ library. The pages also list opening encrypted PDF files, and loading documents from local storage, HTTP/HTTPS and cloud sources.

For a banking app, the practical benefit is control. The document is parsed and rendered by a library inside your own app process, so you never hand the file to a third-party viewer through a share sheet or intent. The licensing terms reinforce this design. The SDK and its activation key “cannot be included in any external plugins, software modules, or printer drivers (i.e., via Android intent mechanisms)”.

What to decide before you build

One license per app identifier. Each license covers one application, identified by its package name, bundle ID or UUID, on one platform. Android build flavors with different applicationId values each need their own key, as KB #126 explains.
No shared modules. You cannot package the SDK as a shared plugin or module used by several of the bank’s apps.
Demo builds are not production builds. Unlicensed builds “impose limits on certain APIs and display a Standard Watermark”. For staging, testing and training, the fact sheet describes Not-For-Resale (NFR) licenses at 15% of the standard price. NFR builds must never reach production.
Private distribution needs an OEM-like license. Distribution through private channels requires one. That includes enterprise distribution through the App Store or Google Play, private websites, email and cloud storage. The license is subject to a qualification interview and a EULA addendum.
Server and mobile together. If statements are generated on a server and opened on phones, budget for both a server license and a mobile license per app and platform.

Frequently asked questions

Can RadaeePDF verify digital signatures in a banking app?

Yes. The Master SDK for Android and the Server Java binding expose signature fields and a signature verification call, so the app can check that a signed contract has not been altered.

Can statements be protected with AES-256?

Yes. EncryptAs with method 3 writes an AES-256 encrypted copy with user and owner passwords and permission bits. It requires a Premium license.

Can the same engine generate statements on the server?

Yes. The RadaeePDF Server SDK runs the same native engine on Windows and Linux, so statements can be generated, rendered and protected in backend jobs before they reach the mobile app.

Tag: digital signatures

Secure PDF SDK Workflows for Banking Apps